summaryrefslogtreecommitdiffstats
path: root/clang/lib/StaticAnalyzer/Checkers
Commit message (Collapse)AuthorAgeFilesLines
...
* [analyzer] Fix the bug in UninitializedObjectChecker caused by not handling ↵George Karpenkov2018-08-091-2/+3
| | | | | | | | block pointers Differential Revision: https://reviews.llvm.org/D50523 llvm-svn: 339369
* [analyzer][UninitializedObjectChecker] Pointer/reference objects are ↵Kristof Umann2018-08-081-34/+75
| | | | | | | | | | | | | | | | dereferenced according to dynamic type This patch fixed an issue where the dynamic type of pointer/reference object was known by the analyzer, but wasn't obtained in the checker, which resulted in false negatives. This should also increase reliability of the checker, as derefencing is always done now according to the dynamic type (even if that happens to be the same as the static type). Special thanks to Artem Degrachev for setting me on the right track. Differential Revision: https://reviews.llvm.org/D49199 llvm-svn: 339240
* [analyzer][UninitializedObjectChecker] Fixed a false negative by no longer ↵Kristof Umann2018-08-081-15/+33
| | | | | | | | | | | | | | | | | filtering out certain constructor calls As of now, all constructor calls are ignored that are being called by a constructor. The point of this was not to analyze the fields of an object, so an uninitialized field wouldn't be reported multiple times. This however introduced false negatives when the two constructors were in no relation to one another -- see the test file for a neat example for this with singletons. This patch aims so fix this issue. Differential Revision: https://reviews.llvm.org/D48436 llvm-svn: 339237
* [analyzer][UninitializedObjectChecker] New flag to turn off dereferencingKristof Umann2018-08-071-8/+35
| | | | | | | | | | | Even for a checker being in alpha, some reports about pointees held so little value to the user that it's safer to disable pointer/reference chasing for now. It can be enabled with a new flag, in which case checker should function as it has always been. This can be set with `CheckPointeeInitialization`. Differential Revision: https://reviews.llvm.org/D49438 llvm-svn: 339135
* [analyzer] InnerPointerChecker: fix displayed checker name.Reka Kovacs2018-08-063-8/+28
| | | | | | | | | | | | | | | | For InnerPointerChecker to function properly, both the checker itself and parts of MallocChecker that handle relevant use-after-free problems need to be turned on. So far, the latter part has been developed within MallocChecker's NewDelete sub-checker, often causing warnings to appear under that name. This patch defines a new CheckKind within MallocChecker for the inner pointer checking functionality, so that the correct name is displayed in warnings and in the ExplodedGraph. Tested on clang-tidy. Differential Review: https://reviews.llvm.org/D50211 llvm-svn: 339067
* [analyzer] Add test for a crash fixed in r338775.Reka Kovacs2018-08-031-4/+1
| | | | | | | | Do not crash if a CXXRecordDecl cannot be obtained for an object. Special thanks for the reproduction to Alexander Kornienko. llvm-svn: 338918
* [analyzer] Detect pointers escaped after ReturnStmt execution in MallocChecker.Reka Kovacs2018-08-021-3/+25
| | | | | | | | | | Objects local to a function are destroyed right after the statement returning (part of) them is executed in the analyzer. This patch enables MallocChecker to warn in these cases. Differential Revision: https://reviews.llvm.org/D49361 llvm-svn: 338780
* [analyzer] Obtain a ReturnStmt from a CFGAutomaticObjDtor.Reka Kovacs2018-08-021-0/+19
| | | | | | | | | | | The CoreEngine only gives us a ReturnStmt if the last element in the CFGBlock is a CFGStmt, otherwise the ReturnStmt is nullptr. This patch adds support for the case when the last element is a CFGAutomaticObjDtor, by returning its TriggerStmt as a ReturnStmt. Differential Revision: https://reviews.llvm.org/D49811 llvm-svn: 338777
* [analyzer] Add a safety check to InnerPointerChecker.Reka Kovacs2018-08-021-2/+5
| | | | | | Do not crash if the CXXRecordDecl of an object is not available. llvm-svn: 338775
* [analyzer] CStringChecker: Remember to highlight the argument expression range.Artem Dergachev2018-07-301-0/+1
| | | | | | | | | | | | | | | | | | | | | When emitting a bug report, it is important to highlight which argument of the call-expression is causing the problem. Before: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^~~~~~~~~~~~ After: warning: Null pointer argument in call to string comparison function   strcmp(a, b);   ^      ~ Affects other output modes as well, not just text. Differential Revision: https://reviews.llvm.org/D50028 llvm-svn: 338333
* [analyzer] Bugfix for autorelease + main run loop leak checkerGeorge Karpenkov2018-07-301-4/+9
| | | | | | | | | Do not warn when the other message-send-expression is correctly wrapped in a different autorelease pool. Differential Revision: https://reviews.llvm.org/D49921 llvm-svn: 338314
* [analyzer] Fix crash in RunLoopAutoreleaseChecker on empty childrenGeorge Karpenkov2018-07-301-2/+3
| | | | | | Differential Revision: https://reviews.llvm.org/D50012 llvm-svn: 338312
* Remove trailing spaceFangrui Song2018-07-303-25/+25
| | | | | | sed -Ei 's/[[:space:]]+$//' include/**/*.{def,h,td} lib/**/*.{cpp,h} llvm-svn: 338291
* [analyzer] Add missing state transition in IteratorChecker.Reka Kovacs2018-07-301-0/+2
| | | | | | | | | After cleaning up program state maps in `checkDeadSymbols()`, a transition should be added to generate the new state. Differential Revision: https://reviews.llvm.org/D47417 llvm-svn: 338263
* [analyzer] Add support for more invalidating functions in InnerPointerChecker.Reka Kovacs2018-07-302-61/+132
| | | | | | | | | | | | According to the standard, pointers referring to the elements of a `basic_string` may be invalidated if they are used as an argument to any standard library function taking a reference to non-const `basic_string` as an argument. This patch makes InnerPointerChecker warn for these cases. Differential Revision: https://reviews.llvm.org/D49656 llvm-svn: 338259
* [Analyzer] Iterator Checker Hotfix: Defer deletion of container data until ↵Adam Balogh2018-07-301-1/+22
| | | | | | | | | | | | | | its last iterator is cleaned up The analyzer may consider a container region as dead while it still has live iterators. We must defer deletion of the data belonging to such containers until all its iterators are dead as well to be able to compare the iterator to the begin and the end of the container which is stored in the container data. Differential Revision: https://reviews.llvm.org/D48427 llvm-svn: 338234
* [analyzer] Syntactic matcher for leaks associated with run loop and ↵George Karpenkov2018-07-252-0/+218
| | | | | | | | | | | | | | | | | | | | | | | autoreleasepool A checker for detecting leaks resulting from allocating temporary autoreleasing objects before starting the main run loop. Checks for two antipatterns: 1. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in the same autorelease pool. 2. ObjCMessageExpr followed by [[NARunLoop mainRunLoop] run] in no autorelease pool. Happens-before relationship is modeled purely syntactically. rdar://39299145 Differential Revision: https://reviews.llvm.org/D49528 llvm-svn: 337876
* [CStringSyntaxChecker] Improvements of strlcpy checkDavid Carlier2018-07-231-2/+18
| | | | | | | | | | | | Adding an additional check whenwe offset fro the buffer base address. Reviewers: george.karpenkov,NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D49633 llvm-svn: 337721
* [CStringSyntaxChecker] Fix build bot builds != x86 archsDavid Carlier2018-07-201-8/+9
| | | | | | | | | | Reviewers: NoQ,george.karpenkov Reviewed By: NoQ Differential Revision: https://reviews.llvm.org/D49588 llvm-svn: 337611
* [analyzer] Rename DanglingInternalBufferChecker to InnerPointerChecker.Reka Kovacs2018-07-204-35/+34
| | | | | | Differential Revision: https://reviews.llvm.org/D49553 llvm-svn: 337559
* Change \t to spacesFangrui Song2018-07-202-2/+2
| | | | llvm-svn: 337530
* [CStringSyntaxChecker] Check strlcpy sizeof syntaxDavid Carlier2018-07-191-0/+62
| | | | | | | | | | | | | | | | | The last argument is expected to be the destination buffer size (or less). Detects if it points to destination buffer size directly or via a variable. Detects if it is an integral, try to detect if the destination buffer can receive the source length. Updating bsd-string.c unit tests as it make it fails now. Reviewers: george.karpenpov, NoQ Reviewed By: george.karpenkov Differential Revision: https://reviews.llvm.org/D48884 llvm-svn: 337499
* [analyzer] Fix memory sanitizer error in MallocChecker.Reka Kovacs2018-07-191-3/+3
| | | | | | | | StringRef's data() returns a string that may be non-null-terminated. Switch to using StringRefs from const char pointers in visitor notes to avoid problems. llvm-svn: 337474
* [analyzer] Fix disappearing notes in DanglingInternalBufferChecker testsReka Kovacs2018-07-191-2/+3
| | | | | | Correct a mistake of the exact same kind I am writing this checker for. llvm-svn: 337466
* [analyzer] Add support for more basic_string API inReka Kovacs2018-07-192-11/+71
| | | | | | | | | | | | | DanglingInternalBufferChecker. A pointer referring to the elements of a basic_string may be invalidated by calling a non-const member function, except operator[], at, front, back, begin, rbegin, end, and rend. The checker now warns if the pointer is used after such operations. Differential Revision: https://reviews.llvm.org/D49360 llvm-svn: 337463
* [analyzer] Make checkEndFunction() give access to the return statement.Reka Kovacs2018-07-169-17/+23
| | | | | | Differential Revision: https://reviews.llvm.org/D49387 llvm-svn: 337215
* [analyzer] Fix GCDAntipatternChecker to only fire when the semaphore is ↵George Karpenkov2018-07-161-1/+3
| | | | | | | | | | | | initialized to zero Initializing a semaphore with a different constant most likely signals a different intent rdar://41802552 Differential Revision: https://reviews.llvm.org/D48911 llvm-svn: 337212
* [Analyzer] Mark `SymbolData` parts of iterator position as live in program ↵Adam Balogh2018-07-161-21/+33
| | | | | | | | | | | | | | state maps Marking a symbolic expression as live is non-recursive. In our checkers we either use conjured symbols or conjured symbols plus/minus integers to represent abstract position of iterators, so in this latter case we also must mark the `SymbolData` part of these symbolic expressions as live to prevent them from getting reaped. Differential Revision: https://reviews.llvm.org/D48764 llvm-svn: 337151
* [Analyzer] alpha.unix.cstring.OutOfBounds checker enable/disable fixAdam Balogh2018-07-131-6/+6
| | | | | | | | | | | | | | | | | | It was not possible to disable alpha.unix.cstring.OutOfBounds checker's reports since unix.Malloc checker always implicitly enabled the filter. Moreover if the checker was disabled from command line (-analyzer-disable-checker ..) the out of bounds warnings were nevertheless emitted under different checker names such as unix.cstring.NullArg, or unix.Malloc. This patch fixes the case sot that Malloc checker only enables implicitly the underlying modeling of strcpy, memcpy etc. but not the warning messages that would have been emmitted by alpha.unix.cstring.OutOfBounds Patch by: Dániel Krupp Differential Revision: https://reviews.llvm.org/D48831 llvm-svn: 337000
* [analyzer][UninitializedObjectChecker] Fixed captured lambda variable nameKristof Umann2018-07-131-18/+21
| | | | | | Differential Revision: https://reviews.llvm.org/D48291 llvm-svn: 336995
* [analyzer][UninitializedObjectChecker] Support for MemberPointerTypesKristof Umann2018-07-131-29/+11
| | | | | | Differential Revision: https://reviews.llvm.org/D48325 llvm-svn: 336994
* [analyzer][UninitializedObjectChecker] Moved non-member functions out of the ↵Kristof Umann2018-07-121-17/+17
| | | | | | | | | | | anonymous namespace As the code for the checker grew, it became increasinly difficult to see whether a function was global or statically defined. In this patch, anything that isn't a type declaration or definition was moved out of the anonymous namespace and is marked as static. llvm-svn: 336901
* [analyzer] Track multiple raw pointer symbols in DanglingInternalBufferChecker.Reka Kovacs2018-07-111-18/+50
| | | | | | | | | | | | Previously, the checker only tracked one raw pointer symbol for each container object. But member functions returning a pointer to the object's inner buffer may be called on the object several times. These pointer symbols are now collected in a set inside the program state map and thus all of them is checked for use-after-free problems. Differential Revision: https://reviews.llvm.org/D49057 llvm-svn: 336835
* [analyzer] Partial revert of https://reviews.llvm.org/D49050George Karpenkov2018-07-111-8/+7
| | | | llvm-svn: 336755
* [analyzer] Pass through all arguments from the registerChecker() to the ↵George Karpenkov2018-07-111-7/+8
| | | | | | | | | | checker constructor A lot of checkers could be cleaned up in a similar way Differential Revision: https://reviews.llvm.org/D49050 llvm-svn: 336753
* [analyzer] Add support for data() in DanglingInternalBufferChecker.Reka Kovacs2018-07-071-5/+6
| | | | | | | | | DanglingInternalBufferChecker now tracks use-after-free problems related to the incorrect usage of std::basic_string::data(). Differential Revision: https://reviews.llvm.org/D48532 llvm-svn: 336497
* [analyzer] Highlight c_str() call in DanglingInternalBufferChecker.Reka Kovacs2018-07-073-10/+88
| | | | | | | | | | Add a bug visitor to DanglingInternalBufferChecker that places a note at the point where the dangling pointer was obtained. The visitor is handed over to MallocChecker and attached to the report there. Differential Revision: https://reviews.llvm.org/D48522 llvm-svn: 336495
* [analyzer] Fix -Wcovered-switch-default warning in MallocChecker.Reka Kovacs2018-07-071-1/+0
| | | | | | Remove unnecessary default case that caused buildbot failures. llvm-svn: 336493
* [analyzer] Highlight container object destruction in MallocChecker.Reka Kovacs2018-07-071-14/+46
| | | | | | | | | Extend MallocBugVisitor to place a note at the point where objects with AF_InternalBuffer allocation family are destroyed. Differential Revision: https://reviews.llvm.org/D48521 llvm-svn: 336489
* [analyzer][UninitializedObjectChecker] Added a NotesAsWarnings flagKristof Umann2018-06-291-21/+53
| | | | | | | | | | In order to better support consumers of the plist output that don't parse note entries just yet, a 'NotesAsWarnings' flag was added. If it's set to true, all notes will be converted to warnings. Differential Revision: https://reviews.llvm.org/D48285 llvm-svn: 335964
* [Analyzer] Iterator Checker - Part 2: Increment, decrement operators and ↵Adam Balogh2018-06-281-31/+448
| | | | | | | | | | | | | ahead-of-begin checks Add handling of the begin() funcion of containers to the iterator checkers, together with the pre- and postfix ++ and -- operators of the iterators. This makes possible the checking of iterators dereferenced ahead of the begin of the container. Differential Revision: https://reviews.llvm.org/D32642 llvm-svn: 335835
* [analyzer] [NFC] A convenient getter for getting a current stack frameGeorge Karpenkov2018-06-277-16/+14
| | | | | | Differential Revision: https://reviews.llvm.org/D44756 llvm-svn: 335701
* [analyzer] Do not run visitors until the fixpoint, run only once.George Karpenkov2018-06-2614-41/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In the current implementation, we run visitors until the fixed point is reached. That is, if a visitor adds another visitor, the currently processed path is destroyed, all diagnostics is discarded, and it is regenerated again, until it's no longer modified. This pattern has a few negative implications: - This loop does not even guarantee to terminate. E.g. just imagine two visitors bouncing a diagnostics around. - Performance-wise, e.g. for sqlite3 all visitors are being re-run at least 10 times for some bugs. We have already seen a few reports where it leads to timeouts. - If we want to add more computationally intense visitors, this will become worse. - From architectural standpoint, the current layout requires copying visitors, which is conceptually wrong, and can be annoying (e.g. no unique_ptr on visitors allowed). The proposed change is a much simpler architecture: the outer loop processes nodes upwards, and whenever the visitor is added it only processes current nodes and above, thus guaranteeing termination. Differential Revision: https://reviews.llvm.org/D47856 llvm-svn: 335666
* Add const qualifier on FieldChainInfoComparator::operator()Steven Wu2018-06-221-1/+1
| | | | | | | libcxx has user defined warning to check for non const call operator. Silence the warning by adding the const on operator(). llvm-svn: 335366
* [analyzer] Made a buildbot happy.Kristof Umann2018-06-191-7/+9
| | | | | | | Since `isPrimitiveType` was only used in an assert, a builbot with `-Werror` and no asserts enabled failed to build it as it was unused. llvm-svn: 335030
* [analyzer] Checker for uninitialized C++ objectsKristof Umann2018-06-182-0/+670
| | | | | | | | | | | | | | | | | | This checker analyzes C++ constructor calls, and reports uninitialized fields. Due to the nature of this problem (uninitialized fields after an object construction), this checker doesn't search for bugs, but rather is a tool to enforce a specific programming model where every field needs to be initialized. This checker lands in alpha for now, and a number of followup patches will be made to reduce false negatives and to make it easier for the user to understand what rules the checker relies on, eg. whether a derived class' constructor is responsible for initializing inherited data members or whether it should be handled in the base class' constructor. Differential Revision: https://reviews.llvm.org/D45532 llvm-svn: 334935
* [analyzer] Clean up the program state map of DanglingInternalBufferChecker.Reka Kovacs2018-06-091-1/+22
| | | | | | | | | | Symbols are cleaned up from the program state map when they go out of scope. Memory regions are cleaned up when the corresponding object is destroyed, and additionally in 'checkDeadSymbols' in case destructor modeling was incomplete. Differential Revision: https://reviews.llvm.org/D47416 llvm-svn: 334352
* [analyzer] Add dangling internal buffer check.Reka Kovacs2018-06-094-2/+139
| | | | | | | | | | | | This check will mark raw pointers to C++ standard library container internal buffers 'released' when the objects themselves are destroyed. Such information can be used by MallocChecker to warn about use-after-free problems. In this first version, 'std::basic_string's are supported. Differential Revision: https://reviews.llvm.org/D47135 llvm-svn: 334348
* [analyzer] Trust _Nonnull annotations, and trust analyzer knowledge about ↵George Karpenkov2018-05-311-5/+43
| | | | | | | | | | | | | | | receiver nullability Previously, the checker was using the nullability of the expression, which is nonnull IFF both receiver and method are annotated as _Nonnull. However, the receiver could be known to the analyzer to be nonnull without being explicitly marked as _Nonnull. rdar://40635584 Differential Revision: https://reviews.llvm.org/D47510 llvm-svn: 333612
* [analyzer] Remove the redundant check about same state transition in ↵Henry Wong2018-05-301-3/+1
| | | | | | | | | | | | | | | | `ArrayBoundCheckerV2.cpp`. Summary: Since the `addTransitionImpl()` has a check about same state transition, there is no need to check it in `ArrayBoundCheckerV2.cpp`. Reviewers: NoQ, xazax.hun, george.karpenkov Reviewed By: NoQ Subscribers: szepet, rnkovacs, a.sidorin, cfe-commits, MTC Differential Revision: https://reviews.llvm.org/D47451 llvm-svn: 333531
OpenPOWER on IntegriCloud